CVE-2026-47406 Overview
CVE-2026-47406 is an Insecure Direct Object Reference (IDOR) vulnerability in PraisonAI Platform, the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 fail to verify that issue and dependency identifiers supplied in requests actually belong to the workspace whose membership is being checked. An authenticated attacker with membership in any single workspace can create, read, or delete dependency links between issues located in arbitrary workspaces across the database. PraisonAI Platform version 0.1.4 remediates the issue by adding cross-object ownership validation. The weakness is classified under [CWE-639].
Critical Impact
An authenticated low-privilege user in one workspace can manipulate issue dependency graphs in workspaces they do not belong to, breaking tenant isolation.
Affected Products
- PraisonAI Platform versions prior to 0.1.4
- The POST /workspaces/{workspace_id}/issues/{issue_id}/dependencies endpoint
- The GET and DELETE /workspaces/{workspace_id}/issues/{issue_id}/dependencies/{dep_id} endpoints
Discovery Timeline
- 2026-07-21 - CVE-2026-47406 published to NVD
- 2026-07-21 - Last updated in NVD database
Technical Details for CVE-2026-47406
Vulnerability Analysis
The vulnerability lives in the dependency management endpoints of the PraisonAI Platform workspace API. Each endpoint enforces authorization by calling require_workspace_member(workspace_id) against the path parameter. The check confirms only that the caller belongs to the workspace named in the URL. It does not validate that the issue_id, dep_id, or depends_on_issue_id parameters resolve to objects owned by that workspace.
After passing the membership gate, the handlers dispatch directly to DependencyService using the raw identifiers from the URL and request body. The service layer trusts those identifiers as authoritative. As a result, tenant isolation collapses at the object layer while appearing intact at the workspace layer.
Root Cause
The root cause is missing object-level authorization. The application confuses workspace membership with object ownership. A single authorization decision is made against workspace_id, then unrelated object identifiers are consumed without any parent-child relationship check.
Attack Vector
An attacker authenticates and joins or creates any workspace where membership is available. They then send a POST request to their own workspace's dependency endpoint but supply an issue_id in the URL and a depends_on_issue_id in the request body that reference issues in a victim workspace. The service persists a blocks or related link between the two arbitrary issues. The same technique enables enumeration through GET and destruction through DELETE against dependency identifiers belonging to other tenants.
No exploit code examples are provided by the vendor. See the GitHub Security Advisory GHSA-4x6r-9v57-3gqw for the authoritative technical write-up.
Detection Methods for CVE-2026-47406
Indicators of Compromise
- Dependency records where the parent issue's workspace_id does not match the workspace_id of the linked depends_on_issue_id.
- Requests to /workspaces/{workspace_id}/issues/{issue_id}/dependencies where the authenticated user's membership set does not include the workspace owning issue_id.
- Unexpected blocks or related links appearing in issue graphs shortly after low-privilege user activity.
Detection Strategies
- Add a database integrity query that joins the dependencies table to the issues table on both sides and flags rows whose two issues belong to different workspaces.
- Instrument the dependency endpoints to log the resolved workspace_id of every referenced issue and alert on mismatches with the URL parameter.
- Correlate application logs to identify accounts issuing dependency mutations against issue identifiers they have never previously read.
Monitoring Recommendations
- Ingest PraisonAI Platform application logs into a centralized SIEM or data lake and retain HTTP request bodies for the dependency endpoints.
- Baseline normal dependency creation rates per user and alert on volumetric anomalies that may indicate enumeration.
- Monitor for accounts that create many workspace memberships in short windows, a common precursor to IDOR abuse.
How to Mitigate CVE-2026-47406
Immediate Actions Required
- Upgrade PraisonAI Platform to version 0.1.4 or later without delay.
- Audit the dependencies table for rows whose two referenced issues reside in different workspaces and remove or quarantine offending records.
- Rotate API tokens for any account suspected of exploiting the endpoints.
Patch Information
PraisonAI Platform version 0.1.4 patches the issue. The upstream fix is tracked in Pull Request #1685 and delivered in commit ef79b7a. Full remediation details are published in the GitHub Security Advisory GHSA-4x6r-9v57-3gqw.
Workarounds
- Restrict workspace membership provisioning so that untrusted users cannot obtain the low privilege required to reach the dependency endpoints.
- Place a reverse proxy or API gateway rule in front of /workspaces/{workspace_id}/issues/{issue_id}/dependencies that rejects requests until the upgrade is applied.
- If upgrade is not immediately possible, disable the dependency endpoints at the application router level.
# Upgrade PraisonAI Platform to the patched release
pip install --upgrade "praisonai>=0.1.4"
# Verify the installed version
python -c "import praisonai; print(praisonai.__version__)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
